Why Are Cookies Called Cookies? A Plain-English Guide
You accept them on every website, but where does the name even come from — and what are they actually doing? Here's where "cookie" comes from, what a cookie really is, where it's stored, and exactly how to view, allow, or block cookies in any browser.
Why are cookies called cookies? The name comes from "magic cookie" — an old computing term for a small piece of data a program passes back and forth, unchanged, to remember something. When Netscape engineer Lou Montulli built the feature for the web in 1994, he borrowed that existing term, and "cookie" stuck.
A cookie itself is just a tiny text file a website asks your browser to store, so it can remember you — that you're logged in, what's in your cart, or (less innocently) which sites you've visited. This is a plain-English guide, not legal advice.
"Cookie" is one of those tech words everybody uses and nobody questions. You click "Accept cookies" a dozen times a day. But why cookies? Not crumbs, not tokens, not tags — cookies. The answer is a genuinely fun piece of computing history, and understanding it also explains what these little files actually do. Let's start with the name, then work through everything a cookie is, where it lives, and how to control it.
Why are internet cookies called cookies?
The short version: the name was borrowed, not invented. Long before the web existed, programmers used the term "magic cookie" to describe a small packet of data that one program hands to another and gets back later, unchanged — a token used to remember something about a session. The idea is a bit like a coat-check ticket: the ticket itself is meaningless, but it lets the system match you to your coat later.
In 1994, a Netscape Communications engineer named Lou Montulli was building a way for websites to remember state between visits — so an online store could keep items in your cart as you moved between pages. He needed a name for the small piece of data the browser would store and send back.
Rather than coin something new, he reused the existing programmer's term "magic cookie." The web version kept the second half of the name, and "cookie" entered everyday language. That's the whole origin story — no bakery metaphor, no marketing focus group. It's why browser cookies, internet cookies, and web cookies are all just "cookies": they inherited the name from a decades-old computing concept.
So when people ask "why are browser cookies called cookies" or "why are cookies called cookies," the honest answer is: because the engineer who built them borrowed a term that already meant "a small bit of remembered data." The name is a piece of programming folklore that outlived its origins.
What is a cookie, exactly? (Cookie, defined)
Now the definition itself.
A small text file (typically a few kilobytes) that a website asks your browser to store on your device. It holds short pieces of information — an ID, a preference, a session token — that the site can read back on your next request, so it can "remember" you.
That's it. A cookie is not a program, can't run code, and isn't a virus. It's a small labeled note — a name and a value, like cart_id = 4X9F2 — plus a few settings that control how long it lasts and who can read it. When your browser talks to a website, it sends back the cookies that belong to that site, and the site uses them to recognize you.
Cookies exist because the web is, by default, forgetful. Each page request is treated as brand new — the server has no built-in memory that you're the same person who logged in two clicks ago. Cookies are the workaround: a little persistent memory that turns a series of disconnected requests into a continuous experience. Without them, you'd be logged out every time you clicked a link, and your shopping cart would empty on every page.
Where are cookies stored?
Cookies live on your device, inside your browser — not on the website's server. Each browser keeps its own cookie storage, which is why signing into a site on Chrome doesn't sign you in on Safari: they don't share cookie jars.
You don't need to know the exact file path to manage cookies (every browser gives you a settings screen for that — see below), but for the curious: browsers keep cookies in a small internal database in your user profile folder. On a Mac, Chrome's cookies live deep inside ~/Library/Application Support/Google/Chrome/; Safari stores them under ~/Library/Cookies/. On Windows, Chrome keeps them in your AppData profile folder. You'll almost never open these directly — and you shouldn't need to — because the browser's own settings screen is the safe way to view, allow, or clear them.
Because cookies are stored in your browser on your device, you're always in control of them. You can view every cookie a site has set, delete them, or block them entirely — no website can stop you. We'll walk through exactly how below.
The main types of cookies
Not all cookies are the same, and the differences matter — especially for privacy. There are two useful ways to slice them: by how long they last, and by who they belong to.
By lifespan: session vs persistent
Session cookies
Temporary. A session cookie exists only while your browser tab is open and is deleted the moment you close it. These handle short-term memory — keeping you logged in as you move around a site, or holding your cart during a single visit.
Persistent cookies
Stored with an expiry date, so they survive after you close the browser — for days, months, or longer. These remember you between visits: your language choice, "keep me logged in," or a returning-visitor ID.
The distinction matters more than it first appears — it affects how long a site can remember you and how much control you have. If you want the full breakdown, see our deeper guide on session cookies vs persistent cookies.
By ownership: first-party vs third-party
This is the distinction that matters most for privacy.
First-party Usually fine
Set by the website you're actually visiting. These are the "helpful" cookies — your login, your cart, your preferences. The site needs them to work, and they generally stay with that site.
Third-party The tracking kind
Set by someone other than the site you're on — an ad network, an analytics company, a social pixel. Because the same third party appears on many sites, it can follow you across the web and build a profile. This is the "cookies advertising" people worry about.
You'll also hear about a security setting called an HttpOnly cookie. An HttpOnly cookie is one the website flags so that JavaScript running in the page can't read it — only the server can. It's a protection against certain attacks that try to steal cookies (like session tokens) through malicious scripts. You don't set this yourself; site developers do. Another related setting is SameSite — modern browsers like Chrome now default cookies to SameSite=Lax, which limits when third-party cookies get sent and is part of the broader industry move away from cross-site tracking. (If you've seen a chrome://flags option about "SameSite by default cookies," that's the setting that enforces this behavior.)
How a cookie works, step by step
Here's the whole exchange, start to finish. It happens in milliseconds, every time you visit a site.
- You visit a site. Your browser requests a page from the website's server.
- The site sets a cookie. Along with the page, the server sends a small instruction —
Set-Cookie: id=4X9F2— asking your browser to remember a value. - Your browser stores it. The cookie goes into your browser's cookie storage on your device.
- On your next request, it comes back. Your browser automatically includes that cookie, so the site knows it's you — no need to log in again or rebuild your cart.
Which cookies fire before you say yes?
Third-party tracking cookies often load the moment a page opens — before a visitor agrees to anything. Run a free scan to see exactly which trackers and cookies fire before consent on any site, in about 10 seconds. No account needed.
How to view cookies in your browser
Want to see the actual cookies a site has stored? Every major browser lets you inspect them. Here's how to find and view cookies in Chrome, plus the equivalent in Safari and Firefox.
- Click the three-dot menu (⋮) in the top-right, then Settings.
- Go to Privacy and security → Third-party cookies (or Cookies and other site data).
- Click See all site data and permissions to view every site that has stored cookies, with the ability to search, inspect, or delete per site.
- Power-user shortcut: press
F12to open DevTools, go to the Application tab, and expand Cookies in the left panel to see each cookie's name, value, expiry, and flags (including HttpOnly and SameSite).
- Open Safari → Settings (or Preferences) from the menu bar.
- Go to the Privacy tab and click Manage Website Data.
- You'll see every site storing cookies and data on your Mac — search, remove one, or Remove All.
- Open the menu (☰) → Settings → Privacy & Security.
- Scroll to Cookies and Site Data and click Manage Data to view and remove stored cookies by site.
How to allow or turn on cookies
If a site isn't working — you can't stay logged in, or your cart keeps emptying — cookies may be turned off. Here's how to allow cookies across the common browsers and devices.
- Open ⋮ menu → Settings → Privacy and security → Third-party cookies.
- Choose Allow third-party cookies (or, more privacy-friendly, "Block third-party cookies in Incognito"). To allow all cookies, make sure general site data isn't blocked under Cookies and other site data.
- To allow cookies for just one site, click the tune/settings icon in the address bar on that site and set cookies to Allow.
- Allow cookies on a Mac (Safari): Safari → Settings → Privacy → make sure "Block all cookies" is unchecked. That allows cookies while keeping Safari's tracking protection on.
- Turn on cookies in Safari on iPhone/iPad: Settings app → Safari → Advanced → ensure Block All Cookies is off.
- Allowing cookies on Android (Chrome): open Chrome → ⋮ → Settings → Site settings → Third-party cookies → choose Allow.
Allowing first-party cookies keeps sites working normally. Allowing third-party cookies is what opens the door to cross-site tracking. Most people can leave third-party cookies blocked and lose nothing but ads that follow them around — so only enable them if a specific site genuinely needs it.
How to block or turn off cookies
On the flip side, if you want more privacy, you can block cookies — either all of them or just the third-party tracking kind (the recommended middle ground).
| Browser / device | Where to block cookies | Recommended setting |
|---|---|---|
| Chrome (desktop) | Settings → Privacy and security → Third-party cookies | Block third-party cookies |
| Safari (Mac) | Safari → Settings → Privacy | Leave tracking prevention on; optionally "Block all cookies" |
| Firefox | Settings → Privacy & Security → Enhanced Tracking Protection | "Strict" blocks known trackers |
| Edge | Settings → Cookies and site permissions | Block third-party cookies |
| iPhone / iPad | Settings → Safari → Advanced → Block All Cookies | Usually leave off; tracking prevention is separate |
| Android (Chrome) | Chrome → Settings → Site settings → Third-party cookies | Block third-party cookies |
Blocking all cookies will break logins and carts on many sites, so most privacy-conscious users choose block third-party cookies — you keep the useful first-party ones and shut out most cross-site tracking. You can also delete existing cookies any time from the same settings screens, and browsing in Incognito/Private mode discards cookies when you close the window.
Cookies, consent, and your privacy
Here's where cookies stop being a trivia question and start mattering. The same mechanism that remembers your cart can also track your behavior across dozens of sites — and that's what privacy laws have started to regulate.
When a website shows you a cookie consent banner ("Accept / Reject"), it's usually because laws require the site to get your permission before setting non-essential cookies — especially third-party tracking cookies. In the EU and UK, the GDPR and the ePrivacy rules require consent before tracking cookies load. In the US, laws like the California Consumer Privacy Act (CCPA) give you the right to opt out of the "sale" or "sharing" of your data — which includes a lot of third-party cookie activity.
There's an even sharper edge in California. Under the California Invasion of Privacy Act (CIPA), a wave of lawsuits argues that trackers firing before a visitor consents can amount to unlawful interception — with statutory damages of $5,000 per violation under California Penal Code §637.2. You can see the scale of that litigation in our CIPA Lawsuit Tracker. The practical upshot for site owners: when a cookie fires (before or after consent) has become a legal question, not just a technical one.
For you as a visitor, the takeaways are simple: the "Reject" button on a cookie banner should be as real as the "Accept" one, blocking third-party cookies in your browser is a legitimate and effective privacy step, and clearing cookies periodically limits how much any site can remember about you.
What does a cookie policy look like?
If you run a website, you've probably wondered what a cookie policy should contain. A cookie policy is a short document (often linked from the footer or the consent banner) that tells visitors which cookies your site uses and why. A basic cookie policy sample includes:
- What cookies you use — grouped into categories like strictly necessary, functional, analytics, and advertising.
- Who sets them — first-party (you) vs named third parties (analytics, ad networks).
- What each is for and how long it lasts — session vs persistent, with expiry.
- How visitors can control them — a link to re-open your consent settings, plus browser-level instructions like the ones above.
- The legal basis — consent for non-essential cookies, and how to withdraw it.
The honest version of a cookie policy isn't just a formality — it only holds up if your site actually does what the policy says, meaning non-essential cookies genuinely don't fire until the visitor agrees. That gap between "our banner says we ask first" and "our trackers actually wait" is exactly where the privacy risk (and the lawsuits) live.
Key takeaways
- Cookies are named after "magic cookie," an old programming term for a small piece of remembered data — Netscape's Lou Montulli borrowed it in 1994.
- A cookie is just a tiny text file stored in your browser on your device — it can't run code and isn't a virus.
- Session cookies vanish when you close the tab; persistent cookies remember you between visits.
- First-party cookies make sites work; third-party cookies are the ones that track you across the web.
- You're always in control — every browser lets you view, allow, or block cookies, and blocking third-party cookies is the privacy sweet spot.
- When a cookie fires is now a legal question — consent laws (GDPR, CCPA) and CIPA litigation focus on tracking that happens before you agree.
The bottom line
Cookies got their name from a decades-old programmer's term for a small bit of remembered data — and that's still exactly what they are: tiny text files that let websites recognize you. Most are harmless and genuinely useful. The ones worth watching are third-party tracking cookies, which follow you across sites, and any cookie that fires before you've had a chance to say yes.
As a visitor, you hold the controls: view them, allow the helpful ones, block the trackers. As a site owner, the bar is higher — your cookies should wait for consent, and your cookie policy should match what your site actually does.
See which cookies fire before consent — on any site
Curious what's actually running before you (or your visitors) click "Accept"? Scan any site free to see every tracker and third-party cookie that loads before consent, in about 10 seconds — then, if it's your site, block them with a single prevention-first pixel.
Scan your site free →ConsentPixel — Privacy · Verified helps website owners and agencies control what fires on their pages — blocking third-party trackers and cookies until a visitor genuinely consents, honoring opt-out and Global Privacy Control signals, and logging each decision. This article is a plain-English educational guide, not legal advice.
Frequently asked questions
Why are cookies called cookies?
The name comes from "magic cookie," a term programmers used long before the web to describe a small piece of data that one program passes to another and gets back unchanged, used to remember something about a session. When Netscape engineer Lou Montulli built the web version in 1994 — so sites could remember things like a shopping cart — he reused that existing term, and "cookie" stuck. There's no bakery connection; it's inherited programming folklore, which is why internet cookies, browser cookies, and web cookies all share the name.
Where are cookies stored on my computer?
Cookies are stored on your own device, inside each browser's profile folder — not on the website's server. Every browser keeps its own separate cookie storage, which is why logging into a site in Chrome doesn't log you in on Safari. On a Mac, for example, Safari keeps cookies under your user Library folder and Chrome keeps them in its Application Support folder. You rarely need the file location, though — the browser's settings screen lets you view, allow, or clear cookies safely without touching those files.
How do I turn on or allow cookies in Chrome?
Open Chrome's three-dot menu → Settings → Privacy and security → Third-party cookies (or "Cookies and other site data"), then choose to allow cookies. To allow cookies for just one site, click the settings icon in the address bar on that site and set cookies to Allow. On Android, it's Chrome → Settings → Site settings → Third-party cookies → Allow. Allowing first-party cookies keeps sites working; you can leave third-party cookies blocked for more privacy without breaking most sites.
How do I view the cookies a website has stored?
In Chrome, go to Settings → Privacy and security → Third-party cookies → "See all site data and permissions" to browse every site that has stored cookies. For full technical detail, press F12 to open DevTools, open the Application tab, and expand Cookies to see each cookie's name, value, expiry, and security flags. In Safari on Mac, use Safari → Settings → Privacy → Manage Website Data. In Firefox, it's Settings → Privacy & Security → Cookies and Site Data → Manage Data.
What's the difference between session and third-party cookies?
They describe two different things. "Session" refers to lifespan: a session cookie is temporary and is deleted when you close your browser tab, unlike a persistent cookie that has an expiry date and survives between visits. "Third-party" refers to ownership: a third-party cookie is set by a company other than the site you're visiting — typically an ad network or analytics provider — which lets it follow you across multiple sites. A cookie can be both (a temporary tracking cookie) or neither (a persistent login cookie from the site itself). First-party session cookies are usually harmless; third-party cookies are the ones raised in privacy discussions.
Is it safe to block cookies?
Blocking third-party cookies is safe and recommended — it stops most cross-site tracking and rarely breaks anything, since those cookies mostly serve advertising. Blocking all cookies, including first-party ones, is also safe but less convenient: it will log you out of sites and empty shopping carts, because those rely on cookies to remember you. The common middle ground is to block third-party cookies while allowing first-party cookies, which every major browser supports. You can also delete existing cookies at any time, or browse in Incognito/Private mode, which discards cookies when you close the window.